Privacy Policy

ReplyFast Technologies, registered in Bangladesh (153/E, Purba Rajabazar, Tejgaon, Dhaka-1215, Bangladesh) ("Videmora," "Company," "we," "us," or "our"), operates the Videmora website, application, and related services (collectively, the "Service"). This Privacy Policy describes how we collect, use, disclose, and safeguard personal information when you use the Service, and the rights available to you depending on where you live. Our primary markets are the United States, United Kingdom, Australia, and Canada, so Sections 13–16 address those jurisdictions specifically; Section 17 covers everyone else.

This Policy applies to all visitors, registered users, and other individuals who access the Service ("you," "user"). It does not apply to third-party websites, products, or services linked to or integrated with the Service, which are governed by their own privacy policies.

If you do not agree with this Policy, please discontinue use of the Service.

• "Personal Information" / "Personal Data" means information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with an identified or identifiable individual — this Policy uses "Personal Information" throughout to mean both terms interchangeably, matching whichever term the law of your jurisdiction uses.
• "Face pattern" means a pattern made from a face in a photo that lets us find the same person across your photos (see Section 7). We treat face patterns as sensitive Personal Information everywhere we operate, including as "special category data" and "sensitive information" as those terms are used under GDPR and the Australian Privacy Act, respectively.
• "Content" means any photo, video, text, or other material you upload to, or generate through, the Service.
• "Service Provider" / "Processor" means a third party that processes Personal Information on our behalf and under our instructions.
• "Controller" (EU/UK terminology) means the entity that determines the purposes and means of processing Personal Information — Videmora acts as the Controller for the Personal Information described in this Policy.

3.1 Information you provide directly

3.2 Information collected automatically

3.3 Information generated through AI processing of your Content

Where UK GDPR or EU GDPR applies to you, we rely on the following legal bases to process your Personal Information:

• Performance of a contract — processing your uploaded Content to generate your memory film, since that's the service you've asked us to perform.
• Consent — for face patterns (Section 7), given by ticking the box on the upload screen, and for non-essential cookies (see our Cookie Policy), both of which require your affirmative opt-in under GDPR's treatment of special category data and the UK's Privacy and Electronic Communications Regulations (PECR). You may withdraw consent at any time, as described in Sections 7 and 18, without affecting the lawfulness of processing carried out before withdrawal.
• Legitimate interests — for security, fraud prevention, and service improvement, balanced against your rights and only where our interest is not overridden by your interests or fundamental rights.
• Legal obligation — where we must retain or disclose information to comply with applicable law (e.g., tax recordkeeping, responding to lawful requests from authorities).

The Service relies substantially on artificial intelligence technology, including image analysis technology, large language model text-generation technology, voice synthesis technology, and face pattern matching (Section 7). This processing is automated: no human reviews your Content as a routine part of providing the Service, other than automated moderation and, where necessary, limited human review to investigate abuse reports, security incidents, or legal obligations.

This automated processing determines how faces are matched within your own uploaded photos and how narrative text is generated — it does not make any decision producing a legal or similarly significant effect concerning you (it does not determine eligibility for credit, employment, housing, insurance, or similar outcomes). Under UK/EU GDPR Article 22, you have the right not to be subject to a decision based solely on automated processing that produces such effects; because our processing does not produce such effects, Article 22's core protection is not triggered, but you may still contact us under Section 18 with questions about how this processing works.

We do not sell your Personal Information, anywhere. We share information only in the following circumstances:

6.1 Service providers, by functional category

6.2 Legal & safety disclosures

We may disclose information where required to comply with valid legal process, to enforce our Terms of Service, to detect or prevent fraud or security incidents, to protect the rights, property, or safety of Videmora, our users, or the public, or in connection with a merger, acquisition, financing, or sale of assets (requiring the successor to honor the commitments in this Policy).

6.3 With your direction

When you generate a shareable link, the story text and video become accessible to anyone with the link, until you disable sharing.

Families often have dozens of photos from one day, and the same people appear in many of them. A face pattern helps us recognise who's who, so your film can tell the story of each person correctly.

A face pattern is a type of personal information that can identify a person. The law calls this kind of information biometric data, and we treat it with extra care.

How we keep it safe:

• We make face patterns only while your film is being made.
• We delete them as soon as your film is ready.
• We never sell them, use them for advertising, or use them to train AI.
• Only the service that does the matching can access them, and only for making your film.
• If you'd rather not use this feature, you can still make a film. You'll simply name the people yourself.

Questions or deletion requests? Email support@videmora.com, and we'll reply within 2 business days.

8.1 What voice cloning is. Voice cloning lets a film be narrated in a voice that sounds like a real person. It is optional. Any film can be narrated with a voice from our library instead.

8.2 Who can provide a voice. Only a living person can provide a voice, and only by recording it live through Videmora. We accept three kinds of voice: your own voice; a person in your photos, invited by a private link; a professional narrator, invited by a private link. We do not accept uploaded audio files or recordings made somewhere else. We do not create a voice of anyone who has died. A person under 18 may record their voice only after a parent or legal guardian has agreed. For children under 13, we ask the parent or guardian to confirm their agreement in a way we can verify.

8.3 Why we use it. For you: so your films can be narrated in your own voice, or in the voice of a person or professional you have invited. For the person who recorded the voice: their voice is used only in films made by the account holder who invited them, and only with their agreement. For a professional narrator: their voice is used only for films the account holder asked them to narrate, under the terms they agreed to when recording.

8.4 How we store and use a voice. We keep the original recording in a private area that only the account holder can reach. We use a voice-synthesis service to create a synthetic copy of the voice, and we use that copy only to narrate films for the account holder who invited the person. We do not share a voice or recording with anyone else, and we do not use them to train AI models.

8.5 Who can see and delete a voice. You can see the voices available to your films in your account settings, and listen to a preview of each one before you make a film. You can delete your own voice from there. A person who recorded a voice for your film, or a professional narrator, can delete their voice at any time from the invitation link they used. No email or approval is needed. Once a voice is deleted by its owner, it no longer appears in your settings.

8.6 What deletion removes. When a voice is deleted, we immediately remove the original recording, the saved preview, and the voice itself from our systems. The synthetic copy held by our voice-synthesis service is removed at the same time. We keep a minimal consent record, showing the name and the date of agreement, so we can show that consent was given if it is ever questioned. Copies held in backups are deleted within 30 days.

8.7 What deletion does not change. A film that has already been made keeps its narration, because the narration is part of the finished video. Deleting a voice does not change films already rendered. You can delete those films separately.

Family photographs routinely include people who have never created a Videmora account. When you upload a photo, you represent and warrant that you possess the necessary rights and consent — including, where a depicted individual is a minor, consent from that minor's parent or legal guardian — to have that photo processed as described in this Policy, including the use of face patterns under Section 7. You, the uploading account holder, are solely responsible for obtaining that consent.

If you are an individual who appears in a photo uploaded by another user and wish to exercise a privacy right described in Sections 13–18 with respect to your own data, contact us at Section 23. We will process such requests in accordance with applicable law, which may require verification of your identity and relationship to the relevant account or Content.

The Service is intended for users at least 18 years old, and account registration is restricted accordingly. This is intentionally higher than the minimum age of digital consent in most of our primary markets (commonly 13–16 depending on jurisdiction) because of the sensitivity of the face patterns involved. We do not knowingly collect Personal Information directly from a child for purposes of COPPA (US), the UK's Age Appropriate Design Code, or equivalent frameworks; all account holders are adults, and all uploads are made by an adult rather than collected directly from a child.

Because Videmora is a family-memory product, Content will routinely depict minors as uploaded by a parent, legal guardian, or other authorized adult. If we become aware that data about a minor was uploaded without appropriate authorization, we will investigate and, where warranted, delete the relevant data. Parents or guardians who believe their child's information has been collected inappropriately may contact us using Section 23.

We implement administrative, technical, and physical safeguards designed to protect Personal Information, including encryption in transit (TLS), encryption at rest where supported by our infrastructure providers, database-level access controls restricting each account to its own data, and restricted internal access to production systems on a need-to-know basis. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12.1 California (CCPA/CPRA)

California residents have rights to know, correct, delete, and port their Personal Information; to opt out of sale or sharing (we do not sell or share, and have not in the preceding 12 months); to limit use of sensitive Personal Information including face patterns; to opt out of certain automated-decision profiling (see Section 5); to non-discrimination for exercising these rights; and to appeal a denied request (Section 17). California residents may designate an authorized agent to submit a request, subject to our ability to verify the agent's authority.

12.2 Virginia, Colorado, Connecticut & Utah

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and Utah (UCPA) have rights to access, correct, delete, and port their Personal Information, and to opt out of targeted advertising, sale, and certain profiling. We do not engage in targeted advertising or sell Personal Information. Where these statutes grant an appeal right, see Section 18.

12.3 Illinois, Texas & Washington

See Section 7 for how we make, use and delete face patterns, which applies to residents of these states and to anyone whose face patterns we make.

12.4 Nevada

Nevada residents may direct us not to sell covered information; as stated above, we do not sell Personal Information.

If UK GDPR or EU GDPR applies to you, in addition to the rest of this Policy, you have the following rights, which you may exercise via Section 18:

• Right of access — obtain confirmation of whether we process your data and a copy of it
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten") — request deletion, subject to the retention exceptions in Section 11
• Right to restrict processing — limit how we use your data in certain circumstances
• Right to data portability — receive your data in a structured, commonly-used, machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent at any time, for processing based on consent (Sections 4 and 7), without affecting the lawfulness of prior processing
• Right to lodge a complaint with a supervisory authority — in the UK, the Information Commissioner's Office (ICO); in the EU, your local data protection authority

If you're in Canada, the federal Personal Information Protection and Electronic Documents Act (PIPEDA) applies to our handling of your Personal Information, alongside applicable provincial law (for example, Quebec's Law 25, which applies additional requirements for Quebec residents including a right to data portability and rules on automated decision-making). You have the right to access and request correction of your Personal Information, to withdraw consent (subject to legal or contractual restrictions), and to file a complaint with the Office of the Privacy Commissioner of Canada (or, for Quebec residents, the Commission d'accès à l'information).

If you're in Australia, the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) apply. Face patterns are "sensitive information" under APP 3, requiring your consent to collect except in limited circumstances — consistent with the consent basis described in Section 7. You have the right to access and seek correction of your Personal Information under APP 12–13, and to complain to us directly (Section 23) or, if unresolved, to the Office of the Australian Information Commissioner (OAIC). Consistent with the Notifiable Data Breaches (NDB) scheme, we will notify the OAIC and affected individuals as soon as practicable if an "eligible data breach" occurs, per Section 21.

If you're located somewhere not specifically addressed in Sections 13–16, the general protections described throughout this Policy — our commitment not to sell your data, our face pattern safeguards (Section 7), our retention schedule (Section 11), and our security practices (Section 12) — apply to you regardless of your location. Contact us via Section 22 with any question about how local law interacts with our practices, and we will respond in good faith even where a formal statutory right may not apply in your jurisdiction.

• How to submit a request: email the address in Section 23, or use the account deletion / data export tool within the Service where available.
• Verification: we will take reasonable steps to verify your identity before acting on a request. We will not request more information than reasonably necessary for verification.
• US response time: we confirm receipt within 10 business days and substantively respond within 45 calendar days, extendable by one additional 45-day period with notice to you.
• UK/EU response time: we respond within one (1) month of receipt, extendable by a further two months for complex or numerous requests, with notice to you within the first month explaining the extension, consistent with GDPR Article 12.
• Canada & Australia response time: we respond "as soon as reasonably possible," and in any case within 30 days, consistent with common practice under PIPEDA and the APPs.
• Appeal (US state laws): if we decline a request, you may appeal within 30 days; we respond to appeals within 45 days, and if we uphold the denial, we will explain why and, where required, provide information on how to complain to the applicable regulator.
• No fee: we do not charge a fee to process a request unless it is excessive, repetitive, or manifestly unfounded, in which case we will explain the basis for any fee before proceeding, or may refuse the request as permitted under applicable law.

We use cookies and similar technologies as described in our separate Cookie Policy, incorporated into this Privacy Policy by reference. Where UK PECR or the EU ePrivacy framework applies, we obtain your consent before setting non-essential cookies. We honor the Global Privacy Control ("GPC") signal as a valid opt-out signal where legally required to do so.

ReplyFast Technologies is registered in Bangladesh, and our infrastructure and service providers operate primarily in the United States. If you access the Service from the UK, EU, Canada, Australia, or elsewhere, your information will be transferred to and processed in the United States, where data protection laws differ from those of your home jurisdiction.

Where UK or EU GDPR requires a specific transfer safeguard for this to be lawful, we rely on the European Commission's Standard Contractual Clauses (SCCs) and, for UK data, the UK Addendum to the EU SCCs, as incorporated into our standard agreements with our service providers. Details are available on request per Section 6.

If we become aware of a security incident compromising the confidentiality, integrity, or availability of your Personal Information in a manner requiring notification, we will notify affected individuals and relevant regulators consistent with the specific timing required in your jurisdiction:

• UK/EU: notification to the ICO or relevant supervisory authority without undue delay, and where feasible, within 72 hours of becoming aware, per GDPR Article 33.
• Australia: notification to the OAIC and affected individuals "as soon as practicable" for an eligible data breach, per the Notifiable Data Breaches scheme.
• Canada: notification to the Privacy Commissioner and affected individuals "as soon as feasible" for a breach posing a real risk of significant harm, per PIPEDA.
• United States: notification consistent with the applicable state breach-notification statute, commonly "without unreasonable delay" up to a maximum of 30–60 days depending on the state.

We may update this Policy to reflect changes in our practices or applicable law. We will update the effective date above, and for material changes, provide more prominent notice (such as an in-app notification or email) at least 10 days before the change takes effect where reasonably practicable. Continued use of the Service after a change takes effect constitutes acceptance.

ReplyFast Technologies
Registered address: 153/E, Purba Rajabazar, Tejgaon, Dhaka-1215, Bangladesh
Privacy and data requests: privacy@videmora.com
Support and general inquiries: support@videmora.com
Or use our contact form.